Security audit

Elderly Medication Compliance (Pick-up / To-mouth / Swallow) | 老年人服药动作确认（取药/入口/吞咽）

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it handles sensitive in-home medication video through remote services with hidden identity setup and persistent account data that users should review carefully.

Before installing, confirm you are comfortable sending medication-area videos or URLs to the lifeemergence.com backend, having the skill silently create or reuse an internal user identity, and storing account tokens/report history locally. Use it only with informed consent from the monitored person or guardian, and prefer a tightly controlled account and media source.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (61)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The manifest describes a safety-critical medication-monitoring system with camera-based pose/object detection and caregiver alerting, but the analyzed behavior indicates generic backend/API, storage, identity, and report-listing operations instead. This deception can cause operators to trust the skill with sensitive health video and identity data under false assumptions, while undeclared functionality accesses local state and remote services.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: The YARA hit suggests suspicious metadata/manifest characteristics consistent with tool or manifest poisoning indicators. While this finding alone is not proof of exploitation, in combination with the misleading description and undeclared capabilities it raises concern that the manifest is crafted to influence agent behavior in unsafe ways.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "smyx-elderly-medication-compliance-analysis" description: "Using a fixed camera installed above or beside the home medication area, the system monitors the elderly person's full medication process in real time. With pose estimation and object detection, it recognizes three key steps: (1) picking up — hand takes a tablet/capsule out of the pill box; (2) to-mouth — hand brings the medication to the lips; (3) swallowing — throat/jaw movement indicating a swallow. | 通过家庭药箱区域上方或侧方的固定摄像头，实时监测老年人取药、服药的全过程，利用姿态估计和目标检测技术识别以下三个关�

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill silently initializes internal identity, reuses a default user, and may auto-create user records without user awareness. In a healthcare context, this can mix records across users, expose prior reports, and create unauthorized associations between sensitive medication-monitoring data and a local or cloud account.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file exposes a broad, generic API wrapper with arbitrary POST/PUT/GET/DELETE and CRUD-style helpers that are not constrained to the stated medication-compliance monitoring purpose. In a skill handling sensitive in-home elder monitoring data, such overbroad network capability expands the attack surface and enables unintended data access, modification, or exfiltration if other components can call these methods with attacker-controlled URLs or payloads.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This utility creates or resolves persistent user identities, reads a local key file, and stores identity records in a local database, which is materially broader than the skill's stated purpose of medication-compliance video monitoring. In this context, hidden identity provisioning and persistence increase privacy risk and create an undisclosed account-binding capability that could be abused for tracking or unauthorized service enrollment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The HTTP helper performs broad authenticated API access, auto-login/registration, token handling, and identity propagation unrelated to the narrowly described medication monitoring function. Because this code can transmit identifiers and credentials to remote endpoints, it introduces significant undisclosed data exfiltration and account-side effect risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable behavior involving local files, shell commands, environment access, and network/API calls, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, this creates excessive implicit authority and makes it harder to constrain or audit what the skill may access or execute.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill claims simple medication-action analysis, but the documented workflow also performs cloud historical report retrieval and outputs report links. This broadens data exposure beyond the user's likely expectation and may leak or retrieve prior health-related records tied to an internal identity.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The AI role explicitly instructs: '不要提供医疗建议或具体用药方案，仅输出步骤检测结果与依从性判断.' Later sections describe outputs including '建议与报告链接' and '风险提示、建议与报告链接'. That is an active contradiction between the stated intent and the documented behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default trigger condition is broad enough to activate on essentially any medication-area video analysis request. Overbroad activation increases the chance of accidental execution, unintended file handling, and unnecessary transmission of sensitive health video to backend services.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The keyword trigger relies on common terms like medication, swallowing, reminders, and pill box without enough contextual constraints. In agent environments, this can cause the skill to activate unexpectedly and process sensitive uploads or query records when the user did not intend to invoke this workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow says uploaded attachments are automatically saved locally, but this is not prominently disclosed in the main description or consent flow. For health-related video, undisclosed local persistence raises privacy and retention risks, especially if files contain identifiable medical behavior in the home.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly describes 24-hour continuous camera collection in a private home medication area and exposes a snapshot_url output, but includes no privacy notice, consent requirements, retention limits, access controls, or data-minimization guidance. In the context of elderly care and in-home monitoring, this creates a real privacy and surveillance risk because highly sensitive behavioral and image data could be collected, stored, and shared with family or caregivers without adequate safeguards.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: skills/smyx_common/scripts/config-dev.yaml:2